CVE-2009-0516

SQL injection vulnerability in the classified page classified.php in BusinessSpace 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

Directory traversal

Multiple directory traversal vulnerabilities in WebFrame 0.76 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the 1 currentmod and 2 LANG parameters to mod/index.php...

CVE-2009-0517: Improper Control of Generation of Code

Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fields parameter, which is supplied to an eval function call within the generic function in include/class/tzenv.class. NOTE: some of these details are obtained...

CVE-2009-0526: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in AdaptCMS Lite 1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 url and 2 acuparam parameters, and 3 the URI...

CVE-2008-6116: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the EXtrovert Software Thyme comthyme 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the event parameter to index.php...

CVE-2009-0514: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in WebFrame 0.76 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the 1 currentmod and 2 LANG parameters to mod/index.php...

CVE-2009-0514

CVE-2009-0514 affects WebFrame 0.76 with directory traversal in mod/index.php (parameters: currentmod, LANG). Exploitation enables remote inclusion and execution of arbitrary local files. Base CVSS 2.0 score 7.5 (HIGH); attack vector NETWORK, no authentication required. No remediation details pro...

CVE-2009-0529: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in SnippetMaster Webpage Editor 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the language parameter...

CVE-2009-0514

Multiple directory traversal vulnerabilities in WebFrame 0.76 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the 1 currentmod and 2 LANG parameters to mod/index.php...

CVE-2009-0513: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in WebFrame 0.76 allow remote attackers to execute arbitrary PHP code via a URL in the classFiles parameter to 1 admin/doc/index.php, 2 index.php, and 3 base/menu.php in mod/...

CVE-2009-0517

CVE-2009-0517 affects phpSlash 0.8.1.1 and earlier. The flaw is an eval()-based injection where unvalidated input in the fields parameter is passed to eval() inside tz_env.class, enabling remote PHP code execution with the web server’s privileges. Impact is described as complete impacts to confid...

Sql injection

SQL injection vulnerability in A4Desk PHP Event Calendar allows remote attackers to execute arbitrary SQL commands via the eventid parameter to admin/index.php...

CVE-2008-6104

Summary of CVE-2008-6104 (A4Desk Event Calendar SQLi) Affects: A4Desk PHP Event Calendar.Vulnerability: SQL injection via the eventid parameter to admin/index.php, caused by insufficient input sanitization.Impact: Remote attackers could execute arbitrary SQL commands (partial confidentiality/ int...

CVE-2008-6099: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in RPortal 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the fileop parameter...

CVE-2008-6104: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in A4Desk PHP Event Calendar allows remote attackers to execute arbitrary SQL commands via the eventid parameter to admin/index.php...

CVE-2008-6103: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in A4Desk Event Calendar, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the v parameter...

CVE-2008-6093

SQL injection vulnerability in Noname CMS 1.0: index.php is exploitable when magic_quotes_gpc is disabled. An attacker can pass (1) file_id in the detailansicht action and (2) kategorie in the kategorien action to execute arbitrary SQL commands remotely. Affects Noname CMS 1.0; CVSS metadata indi...

CVE-2008-6093: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Noname CMS 1.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the 1 fileid parameter in a detailansicht action and the 2 kategorie parameter in a kategorien action...

CVE-2008-6097: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in WikyBlog before 1.7.1 allow remote attackers to inject arbitrary web script or HTML via the 1 key parameter to index.php/Special/Main/keywordSearch, 2 revNum parameter to index.php/Edit/Main/Home, 3 to parameter to...

phpYabs 0.1.2 Remote File Inclusion

phpyabs 0.1.2 RFI Vulnerability FOUND BY: Arka69 BUG: Remote File Include RFI CMS: phpyabs 0.1.2 SITE: http://exploita.altervista.org VULNERABLE CODE: phpyabs/moduli/libri/index.php include$GET'Azione'.".php"; RFI: http://victim.com/phpyabs/moduli/libri/index.php?Azione=SHELL...